Analysis
- max time kernel
136s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
10/05/2024, 08:35
General
- Target NEW ORDER CONFIRMATION.scr
- Size 3.0MB
- Sample240510-khdmsagc69
- SHA256 ba58f8ba7420adb8ffa2c999e7b20c1958d353c1146cb5eff41b5057f320f7be
Malware Config
Signatures
- Detect ZGRat V1 35 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER CONFIRMATION.scr"C:\Users\Admin\AppData\Local\Temp\NEW ORDER CONFIRMATION.scr" /S1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwATgBFAFcAIABPAFIARABFAFIAIABDAE8ATgBGAEkAUgBNAEEAVABJAE8ATgAuAHMAYwByADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAATgBFAFcAIABPAFIARABFAFIAIABDAE8ATgBGAEkAUgBNAEEAVABJAE8ATgAuAHMAYwByADsA2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Cdufzr.tmpdb
Fqjiuy.tmpdb
__PSScriptPolicyTest_ufgbh14c.m3n.ps1
memory/624-4889-0x00000000053F0000-0x0000000005444000-memory.dmp
memory/624-4898-0x0000000074DA0000-0x0000000075550000-memory.dmp
memory/624-14-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-10-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-52-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-48-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-30-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-26-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-24-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-22-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-21-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-16-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-8-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-28-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-6-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-18-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-5-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-12-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-54-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-68-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-67-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-64-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-62-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-60-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-58-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-56-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-50-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-46-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-44-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-42-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-40-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-38-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-36-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-34-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-32-0x0000000004CE0000-0x0000000004FC5000-memory.dmp
memory/624-4885-0x0000000074DA0000-0x0000000075550000-memory.dmp
memory/624-4886-0x0000000074DA0000-0x0000000075550000-memory.dmp
memory/624-4888-0x0000000004C20000-0x0000000004C6C000-memory.dmp
memory/624-4887-0x0000000006B30000-0x0000000006C58000-memory.dmp
memory/624-0-0x0000000074DAE000-0x0000000074DAF000-memory.dmp
memory/624-4-0x0000000005070000-0x0000000005102000-memory.dmp
memory/624-1-0x0000000000010000-0x000000000030A000-memory.dmp
memory/624-2-0x0000000004CE0000-0x0000000004FCA000-memory.dmp
memory/624-3-0x0000000005580000-0x0000000005B24000-memory.dmp
memory/3444-7234-0x00000000056A0000-0x000000000573E000-memory.dmp
memory/3444-7322-0x0000000074DA0000-0x0000000075550000-memory.dmp
memory/3444-7320-0x0000000074DA0000-0x0000000075550000-memory.dmp
memory/3444-4894-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/3444-4909-0x0000000074DA0000-0x0000000075550000-memory.dmp
memory/3444-7267-0x0000000007120000-0x000000000719A000-memory.dmp
memory/3444-7266-0x0000000005A50000-0x0000000005A5A000-memory.dmp
memory/3444-7265-0x0000000005EC0000-0x0000000005F30000-memory.dmp
memory/3444-5104-0x0000000074DA0000-0x0000000075550000-memory.dmp
memory/3444-4896-0x0000000005470000-0x0000000005586000-memory.dmp
memory/4780-7251-0x0000000074DA0000-0x0000000075550000-memory.dmp
memory/4780-7256-0x0000000007680000-0x0000000007716000-memory.dmp
memory/4780-7236-0x0000000006170000-0x00000000061BC000-memory.dmp
memory/4780-7249-0x0000000007260000-0x000000000727E000-memory.dmp
memory/4780-7244-0x0000000074DA0000-0x0000000075550000-memory.dmp
memory/4780-7238-0x0000000070C00000-0x0000000070C4C000-memory.dmp
memory/4780-7250-0x00000000072D0000-0x0000000007373000-memory.dmp
memory/4780-7252-0x0000000074DA0000-0x0000000075550000-memory.dmp
memory/4780-7237-0x0000000007280000-0x00000000072B2000-memory.dmp
memory/4780-7233-0x0000000005C70000-0x0000000005FC4000-memory.dmp
memory/4780-7253-0x0000000007A40000-0x00000000080BA000-memory.dmp
memory/4780-7254-0x0000000007400000-0x000000000741A000-memory.dmp
memory/4780-7255-0x0000000007470000-0x000000000747A000-memory.dmp
memory/4780-7235-0x00000000060D0000-0x00000000060EE000-memory.dmp
memory/4780-7257-0x0000000007600000-0x0000000007611000-memory.dmp
memory/4780-7258-0x0000000007630000-0x000000000763E000-memory.dmp
memory/4780-7259-0x0000000007640000-0x0000000007654000-memory.dmp
memory/4780-7260-0x0000000007740000-0x000000000775A000-memory.dmp
memory/4780-7261-0x0000000007720000-0x0000000007728000-memory.dmp
memory/4780-7264-0x0000000074DA0000-0x0000000075550000-memory.dmp
memory/4780-7227-0x00000000053B0000-0x0000000005416000-memory.dmp
memory/4780-7228-0x0000000005490000-0x00000000054F6000-memory.dmp
memory/4780-7226-0x0000000005310000-0x0000000005332000-memory.dmp
memory/4780-4897-0x0000000074DA0000-0x0000000075550000-memory.dmp
memory/4780-4895-0x0000000005640000-0x0000000005C68000-memory.dmp
memory/4780-4890-0x00000000027A0000-0x00000000027D6000-memory.dmp
memory/4780-4893-0x0000000074DA0000-0x0000000075550000-memory.dmp